timecompare
Use the timecompare
command to generate columns with the
results from all the aggregate columns generated by the previous timestats
command over the comparison interval specified. Note that timecompare
command must follow a timestats
command.
Syntax
timecompare shift=<int><timescale> [count=<int>]
Parameters
The following table lists the parameters used in this command, along with their descriptions.
Parameter | Description |
---|---|
span |
Syntax: Sets the size of each compare window using a span length based on time. |
|
Syntax: where: <sec>: Seconds. Syntax: <min>: Minutes. Syntax: <hour>: Hours. Syntax: <week>: Weeks. Syntax: <month>: Months. |
The following command compares the log volume by the number of log lines week over week.
* | timestats span=1d count | timecompare shift=1w
The following command compares the count of errors by an entity week over week.
Severity = error | timestats span=1d count by Entity | timecompare shift=5days 2";